Index: sys/kern/uipc_shm.c
===================================================================
--- sys/kern/uipc_shm.c
+++ sys/kern/uipc_shm.c
@@ -450,9 +450,7 @@
 		error = 0;
 		if ((shmfd->shm_flags & SHM_GROW_ON_WRITE) != 0 &&
 		    size > shmfd->shm_size) {
-			VM_OBJECT_WLOCK(shmfd->shm_object);
-			error = shm_dotruncate_locked(shmfd, size, rl_cookie);
-			VM_OBJECT_WUNLOCK(shmfd->shm_object);
+			error = shm_dotruncate_cookie(shmfd, size, rl_cookie);
 		}
 		if (error == 0)
 			error = uiomove_object(shmfd->shm_object,
@@ -767,6 +765,9 @@
 #endif
 	}
 
+	if ((shmfd->shm_seals & F_SEAL_GROW) != 0)
+		return (EPERM);
+
 	aflags = VM_ALLOC_NORMAL | VM_ALLOC_ZERO;
 	if (shmfd->shm_lp_alloc_policy == SHM_LARGEPAGE_ALLOC_NOWAIT)
 		aflags |= VM_ALLOC_WAITFAIL;
@@ -1594,12 +1595,14 @@
 	mtx_unlock(&shm_timestamp_lock);
 	vm_object_reference(shmfd->shm_object);
 
-	if (writecnt)
-		vm_pager_update_writecount(shmfd->shm_object, 0, objsize);
 	if (shm_largepage(shmfd)) {
 		error = shm_mmap_large(shmfd, map, addr, objsize, prot,
 		    maxprot, flags, foff, writecnt, td);
 	} else {
+		if (writecnt) {
+			vm_pager_update_writecount(shmfd->shm_object, 0,
+			    objsize);
+		}
 		error = vm_mmap_object(map, addr, objsize, prot, maxprot, flags,
 		    shmfd->shm_object, foff, writecnt, td);
 	}
@@ -1838,6 +1841,11 @@
 	}
 	nseals = seals & ~shmfd->shm_seals;
 	if ((nseals & F_SEAL_WRITE) != 0) {
+		if (shm_largepage(shmfd)) {
+			error = ENOTSUP;
+			goto out;
+		}
+
 		/*
 		 * The rangelock above prevents writable mappings from being
 		 * added after we've started applying seals.  The RLOCK here